npm detections from LPM Firewall.

This is concrete credential exfiltration during package runtime, despite no npm lifecycle hook. The explicit workflow template materially enables the transfer.

This is a concrete install-time data-exfiltration chain with obfuscation and shell execution. It is malicious, not package-aligned behavior.

The install lifecycle performs unconsented mutation of broad AI-agent control surfaces. This meets the blocking policy regardless of the otherwise user-invoked LLM functionality.

This is not limited to user-invoked local setup: a connected remote RPC surface can export and replace third-party AI-agent credentials. The benign postinstall helpers do not mitigate the...

The lifecycle hook performs concrete cross-platform AI-agent configuration and prompt installation at npm install time. This meets the blocking policy regardless of the absence of network...

Source directly confirms postinstall-triggered multi-platform agent configuration writes. This meets the blocking policy for unconsented install-time foreign/broad AI-agent control-surfac...

This is concrete import-time installation and manifest mutation of a different registry package, not a user-invoked update command. Absence of npm lifecycle hooks does not mitigate the ru...

This is concrete unconsented import-time mutation of a consumer project, directed at a package name different from the reviewed package. The documented updater claims it installs fca-nx,...

The package has a concrete postinstall chain that downloads remotely controlled content into multiple unrelated agent configuration surfaces. This meets the blocking policy independent of...

This is a concrete, automatically triggered remote-access payload with host fingerprinting and screenshot exfiltration. It is malicious, not an inert bundled artifact.

The package performs concrete privileged, stealthy remote-access provisioning automatically at postinstall. The absence of web exfiltration does not mitigate this local backdoor behavior.

Source directly confirms unconsented install-time creation of a concealed, privileged RDP access path and service masquerading. Absence of JavaScript network exfiltration does not mitigat...

Source establishes a default, recurring export of Claude-derived activity data to a hard-coded external IP. The absence of an npm lifecycle hook does not mitigate the concrete exfiltratio...

The install hook performs destructive competitor-associated credential/config mutation and replaces credentials with a vendor-controlled account. No exfiltration is needed for this concre...

This is a concrete, install-time, unconsented mutation of foreign/broad AI-agent control surfaces. No separate exfiltration or remote payload behavior was found, but the lifecycle control...

The runtime messaging adapters are user-invoked and package-aligned, but the install-time mutation of a foreign project-level agent skill directory is concrete and unconsented.

Source establishes an automatic postinstall mutation path into broad third-party AI-agent skill directories. This meets the policy threshold for blocking despite no demonstrated exfiltrat...

Source confirms a postinstall hook that defaults to injecting package-provided agent instructions into three foreign control surfaces. This meets the install-time AI-agent control-hijack...

The package has no confirmed exfiltration or remote payload chain, but its automatic postinstall force-writes foreign, broad AI-agent control surfaces. This meets the block boundary for u...

The package contains a concrete credential-exfiltration path: automatic import of Happy credentials followed by authenticated transmission to an unrelated hard-coded host. The absence of...